wrapper/libavc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "decoder: fix integer overflow when setting i4_prev_max_display_seq" am: 2c7af2702b am: 1c3a955de7 am: 151a2bcee7

Browse source 
Original change: 1374616

Change-Id: I3e4925e264864b47fb8f242b0c29b30b8cc7ed6a
This commit is contained in:
Ray Essick 2020-07-29 22:25:11 +00:00 • committed by Automerger Merge Worker
commit eaaee0ef0f
2 changed files with 16 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

12
decoder/ih264d_parse_slice.c
View file

@ -826,8 +826,8 @@ WORD32 ih264d_end_of_pic_dispbuf_mgr(dec_struct_t * ps_dec)
ps_cur_pic->u2_crop_offset_uv = ps_dec->u2_crop_offset_uv;
ps_cur_pic->u1_pic_type = 0;
{
UWORD64 i8_display_poc;
i8_display_poc = (UWORD64)ps_dec->i4_prev_max_display_seq +
WORD64 i8_display_poc;
i8_display_poc = (WORD64)ps_dec->i4_prev_max_display_seq +
ps_dec->ps_cur_pic->i4_poc;
if(IS_OUT_OF_RANGE_S32(i8_display_poc))
{
@ -1495,13 +1495,13 @@ WORD32 ih264d_parse_decode_slice(UWORD8 u1_is_idr_slice,
/* IDR Picture or POC wrap around */
if(i4_poc == 0)
{
UWORD64 u8_temp;
u8_temp = (UWORD64)ps_dec->i4_prev_max_display_seq
WORD64 i8_temp;
i8_temp = (WORD64)ps_dec->i4_prev_max_display_seq
+ ps_dec->i4_max_poc
+ ps_dec->u1_max_dec_frame_buffering + 1;
/*If i4_prev_max_display_seq overflows integer range, reset it */
ps_dec->i4_prev_max_display_seq = (u8_temp > 0x7fffffff)?
0 : u8_temp;
ps_dec->i4_prev_max_display_seq = IS_OUT_OF_RANGE_S32(i8_temp)?
0 : i8_temp;
ps_dec->i4_max_poc = 0;
}
}

20
decoder/ih264d_utils.c
View file

@ -1301,7 +1301,7 @@ void ih264d_release_display_bufs(dec_struct_t *ps_dec)
WORD32 i4_min_poc;
WORD32 i4_min_poc_buf_id;
WORD32 i4_min_index;
UWORD64 u8_temp;
WORD64 i8_temp;
dpb_manager_t *ps_dpb_mgr = ps_dec->ps_dpb_mgr;
WORD32 (*i4_poc_buf_id_map)[3] = ps_dpb_mgr->ai4_poc_buf_id_map;
@ -1348,11 +1348,11 @@ void ih264d_release_display_bufs(dec_struct_t *ps_dec)
}
}
ps_dpb_mgr->i1_poc_buf_id_entries = 0;
u8_temp = (UWORD64)ps_dec->i4_prev_max_display_seq + ps_dec->i4_max_poc
i8_temp = (WORD64)ps_dec->i4_prev_max_display_seq + ps_dec->i4_max_poc
+ ps_dec->u1_max_dec_frame_buffering + 1;
/*If i4_prev_max_display_seq overflows integer range, reset it */
ps_dec->i4_prev_max_display_seq = (u8_temp > 0x7fffffff)?
0 : u8_temp;
ps_dec->i4_prev_max_display_seq = IS_OUT_OF_RANGE_S32(i8_temp)?
0 : i8_temp;
ps_dec->i4_max_poc = 0;
}
@ -1624,13 +1624,13 @@ WORD32 ih264d_decode_gaps_in_frame_num(dec_struct_t *ps_dec,
/* IDR Picture or POC wrap around */
if(i4_poc == 0)
{
UWORD64 u8_temp;
u8_temp = (UWORD64)ps_dec->i4_prev_max_display_seq
WORD64 i8_temp;
i8_temp = (WORD64)ps_dec->i4_prev_max_display_seq
+ ps_dec->i4_max_poc
+ ps_dec->u1_max_dec_frame_buffering + 1;
/*If i4_prev_max_display_seq overflows integer range, reset it */
ps_dec->i4_prev_max_display_seq = (u8_temp > 0x7fffffff)?
0 : u8_temp;
ps_dec->i4_prev_max_display_seq = IS_OUT_OF_RANGE_S32(i8_temp)?
0 : i8_temp;
ps_dec->i4_max_poc = 0;
}
@ -1648,8 +1648,8 @@ WORD32 ih264d_decode_gaps_in_frame_num(dec_struct_t *ps_dec,
}
{
UWORD64 i8_display_poc;
i8_display_poc = (UWORD64)ps_dec->i4_prev_max_display_seq +
WORD64 i8_display_poc;
i8_display_poc = (WORD64)ps_dec->i4_prev_max_display_seq +
i4_poc;
if(IS_OUT_OF_RANGE_S32(i8_display_poc))
{